hacking: security in practice
OSCP worthy?
Hello all! In short: I want to know if I am prepared to complete the OSCP/CEH certifications; 1) are they worth it?,
2) fluent in python, Java, sql, (each 4 ish years), and adept in C++ (still learning),
3) have been grinding on tryhackme/hackthebox/ctftime.org - and have actually done well in some CTFs,
4) have ~ 2 1/2 years of experience with both Kali Linux and Ubuntu.
What more, if anything, can I do to prepare for CEH and OSCP? I feel as if I’ve jumped through all the necessary hoops but have no idea what to expect. I just really don’t want to waste my money if I’m truly not “ready”. Possibly experiencing some imposter syndrome, but at the same time how can I actually gauge my readiness?
Any feedback would be greatly appreciated!
submitted by /u/smokeyrb9
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
OSCP worthy?
Hello all! In short: I want to know if I am prepared to complete the OSCP/CEH certifications; 1) are they worth it?,
2) fluent in python, Java, sql, (each 4 ish years), and adept in C++ (still learning),
3) have been grinding on tryhackme/hackthebox/ctftime.org - and have actually done well in some CTFs,
4) have ~ 2 1/2 years of experience with both Kali Linux and Ubuntu.
What more, if anything, can I do to prepare for CEH and OSCP? I feel as if I’ve jumped through all the necessary hoops but have no idea what to expect. I just really don’t want to waste my money if I’m truly not “ready”. Possibly experiencing some imposter syndrome, but at the same time how can I actually gauge my readiness?
Any feedback would be greatly appreciated!
submitted by /u/smokeyrb9
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
OSCP worthy?
Hello all! In short: I want to know if I am prepared to complete the OSCP/CEH certifications; 1) are they worth it?, 2) fluent in python, Java,...
hacking: security in practice
Utilizing proxy authentication and ssl bypass in order to get through a proxy
Hi, wondering if there's already a tool that does something like utilizing proxy authentication and or ssl bypasses to get info out
Not going to do this been working a lot closer to proxies and just generally curious
submitted by /u/onequestion1168
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Utilizing proxy authentication and ssl bypass in order to get through a proxy
Hi, wondering if there's already a tool that does something like utilizing proxy authentication and or ssl bypasses to get info out
Not going to do this been working a lot closer to proxies and just generally curious
submitted by /u/onequestion1168
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Utilizing proxy authentication and ssl bypass in order to get...
Hi, wondering if there's already a tool that does something like utilizing proxy authentication and or ssl bypasses to get info out Not going to...
hacking: security in practice
lets say i give u my ip address can u hack me
i want to get educated on is it possible for a hacker to hack me with my ip address. Will they ableto access the notepad files on my desktop?
lets say i keep 100$ of bitcoin keys declare it publicly with ip address just for a test do u guys think i will get haked.
SYSTEM specs: windows 10 AME last security patch march 21, with no firewall, no antivirus but its a clean install with sure zero virus.
i also have a deep freeze installed it cleans everything at every reboot.
submitted by /u/abhilodha
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
lets say i give u my ip address can u hack me
i want to get educated on is it possible for a hacker to hack me with my ip address. Will they ableto access the notepad files on my desktop?
lets say i keep 100$ of bitcoin keys declare it publicly with ip address just for a test do u guys think i will get haked.
SYSTEM specs: windows 10 AME last security patch march 21, with no firewall, no antivirus but its a clean install with sure zero virus.
i also have a deep freeze installed it cleans everything at every reboot.
submitted by /u/abhilodha
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
lets say i give u my ip address can u hack me
i want to get educated on is it possible for a hacker to hack me with my ip address. Will they ableto access the notepad files on my...
FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor | Microsoft Security Blog
https://www.reddit.com/r/redteamsec/comments/pxntg3/foggyweb_targeted_nobelium_malware_leads_to/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/) [comments] (https://www.reddit.com/r/redteamsec/comments/pxntg3/foggyweb_targeted_nobelium_malware_leads_to/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/pxntg3/foggyweb_targeted_nobelium_malware_leads_to/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/) [comments] (https://www.reddit.com/r/redteamsec/comments/pxntg3/foggyweb_targeted_nobelium_malware_leads_to/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor |...
Posted in r/redteamsec by u/dmchell • 2 points and 0 comments
Simple Parameter Tampering → Account Takeover
https://darshan-jogi.medium.com/simple-parameter-tampering-account-takeover-3fec3cb51eb6?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://darshan-jogi.medium.com/simple-parameter-tampering-account-takeover-3fec3cb51eb6?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Simple Parameter Tampering → Account Takeover
Introduction:
Introduction:Continue reading on Medium » (https://darshan-jogi.medium.com/simple-parameter-tampering-account-takeover-3fec3cb51eb6?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Simple Parameter Tampering → Account Takeover
Introduction:
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Password-Checker CSAW CTF 2021 Write-Up
https://cdn-images-1.medium.com/max/625/1*A3-3K-PtQ6Mxo9VjUoxBMQ.png
This is a warm-up challenge for Binary Exploitation.
Continue reading on InfoSec Write-ups »
___________________________
@hacking_Attack
@Hacking_Video
Password-Checker CSAW CTF 2021 Write-Up
https://cdn-images-1.medium.com/max/625/1*A3-3K-PtQ6Mxo9VjUoxBMQ.png
This is a warm-up challenge for Binary Exploitation.
Continue reading on InfoSec Write-ups »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Password-Checker CSAW CTF 2021 Write-Up
This is a warm-up challenge for Binary Exploitation.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
BlackArch Linux
https://cdn-images-1.medium.com/max/1920/0*uVuIUh5cX51euJW8.jpg
BlackArch Linux is an Arch Linux-based penetration testing distribution for penetration testers and security researchers. The repository…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
BlackArch Linux
https://cdn-images-1.medium.com/max/1920/0*uVuIUh5cX51euJW8.jpg
BlackArch Linux is an Arch Linux-based penetration testing distribution for penetration testers and security researchers. The repository…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
BlackArch Linux
BlackArch Linux is an Arch Linux-based penetration testing distribution for penetration testers and security researchers. The repository…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Simple Parameter Tampering → Account Takeover
https://cdn-images-1.medium.com/max/758/1*S55NPFmsgZEAsVxM4mitpw.jpeg
Introduction:
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Simple Parameter Tampering → Account Takeover
https://cdn-images-1.medium.com/max/758/1*S55NPFmsgZEAsVxM4mitpw.jpeg
Introduction:
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Simple Parameter Tampering → Account Takeover
Introduction:
LDAP Password Hunter got persistence
https://www.reddit.com/r/redteamsec/comments/pxquo8/ldap_password_hunter_got_persistence/
Hello Everyone, posted already about LDAP Password hunter some time ago receiving a discrete amount of good feedback. Among all the feedbacks some of the latter became new features so here i m again. LPH got persistence now, Results are saved in a sqlite3 database and printed on a file only when new entries are discovered. DB has only one table showing DistinguishedName, AttributeName, Value, Domain. Output is made less verbose and more clean, this is all made in a perspective of continuous attacker mode and monitoring. Thanks in advance for all the feedback regardless it s gonna become new feature or not. Check LPH out here: https://github.com/oldboy21/LDAP-Password-Hunter Cheers! submitted by /u/oldboy21 (https://www.reddit.com/user/oldboy21)
[link] (https://www.reddit.com/r/redteamsec/comments/pxquo8/ldap_password_hunter_got_persistence/) [comments] (https://www.reddit.com/r/redteamsec/comments/pxquo8/ldap_password_hunter_got_persistence/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/pxquo8/ldap_password_hunter_got_persistence/
Hello Everyone, posted already about LDAP Password hunter some time ago receiving a discrete amount of good feedback. Among all the feedbacks some of the latter became new features so here i m again. LPH got persistence now, Results are saved in a sqlite3 database and printed on a file only when new entries are discovered. DB has only one table showing DistinguishedName, AttributeName, Value, Domain. Output is made less verbose and more clean, this is all made in a perspective of continuous attacker mode and monitoring. Thanks in advance for all the feedback regardless it s gonna become new feature or not. Check LPH out here: https://github.com/oldboy21/LDAP-Password-Hunter Cheers! submitted by /u/oldboy21 (https://www.reddit.com/user/oldboy21)
[link] (https://www.reddit.com/r/redteamsec/comments/pxquo8/ldap_password_hunter_got_persistence/) [comments] (https://www.reddit.com/r/redteamsec/comments/pxquo8/ldap_password_hunter_got_persistence/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
LDAP Password Hunter got persistence
Hello Everyone, posted already about LDAP Password hunter some time ago receiving a discrete amount of good feedback. Among all the feedbacks some...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
CrowdSec : An Open-Source Massively Multiplayer Firewall Able To Analyze Visitor Behavior And Provide An Adapted Response To All Kinds Of Attacks
CrowdSec is a free, modern & collaborative behavior detection engine, coupled with a global IP reputation network. It stacks on fail2ban’s philosophy but is IPV6 compatible and 60x faster (Go vs Python), uses Grok patterns to parse logs and YAML scenario to identify behaviors. CrowdSec is engineered for modern Cloud / Containers / VM based infrastructures (by decoupling detection and remediation). Once detected you can remedy threats with various bouncers (firewall block, nginx http 403, Captchas, etc.) while the aggressive IP can be sent to CrowdSec for curation before being shared among all users to further improve everyone’s security. See FAQ or read bellow for more. 2 Mins Install
Installing it through the Package system of your OS is the easiest way to proceed. Otherwise, you can install it from source. From package (Debian)
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
sudo apt-get update
sudo apt-get install crowdsec
From package (rhel/centos/amazon linux)
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.rpm.sh | sudo bash
sudo yum install crowdsec
From package (FreeBSD)
sudo pkg update
sudo pkg install crowdsec
From source
wget https://github.com/crowdsecurity/crowdsec/releases/latest/download/crowdsec-release.tgz
tar xzvf crowdsec-release.tgz
cd crowdsec-v* && sudo ./wizard.sh -i
About The CrowdSec Project
Crowdsec is an open-source, lightweight software, detecting peers with aggressive behaviors to prevent them from accessing your systems. Its user friendly design and assistance offers a low technical barrier of entry and nevertheless a high security gain.
The architecture is as follows :
https://1.bp.blogspot.com/-XuFJkdHOxds/YUx1wJlrJfI/AAAAAAAAK6g/JxO1qbftRyoJr12S1DslU08lSOX9hT49ACLcBGAsYHQ/s851/crowdsec_architecture.png
Once an unwanted behavior is detected, deal with it through a bouncer. The aggressive IP, scenario triggered and timestamp are sent for curation, to avoid poisoning & false positives. (This can be disabled). If verified, this IP is then redistributed to all CrowdSec users running the same scenario. Outnumbering Hackers All Together
By sharing the threat they faced, all users are protecting each-others (hence the name Crowd-Security). Crowdsec is designed for modern infrastructures, with its “Detect Here, Remedy There” approach, letting you analyse logs coming from several sources in one place and block threats at various levels (applicative, system, infrastructural) of your stack.
CrowdSec ships by default with scenarios (brute force, port scan, web scan, etc.) adapted for most context, but you can easily extend it by picking more of them from the HUB. It is also easy to adapt an existing one or create one yourself.
What It Is Not
CrowdSec is not a SIEM, storing your logs (neither locally nor remotely). Your data are analyzed locally and forgotten.
Signals sent to the curation platform are limited to the very strict minimum: IP, Scenario, Timestamp. They are only used to allow the system to spot new rogue IPs, rule out false positives or poisoning attempts.
Install It
Crowdsec is available for various platforms :
* Use our debian repositories or the official debian packages
* An image is available for docker
* Prebuilt release packages are also available (suitable for
* You can as well build it from source
Or look directly at installation documentation for other methods and platforms.
Key Benefits Fast assisted installation, no technical barrier
Initial configuration is automated, providing functional out-of-the-box setup
https://1.bp.blogspot.com/-NhfkXihzIXo/YUx3XpqGO_I/AAAAAAAAK6[...]
___________________________
@hacking_Attack
@Hacking_Video
CrowdSec : An Open-Source Massively Multiplayer Firewall Able To Analyze Visitor Behavior And Provide An Adapted Response To All Kinds Of Attacks
CrowdSec is a free, modern & collaborative behavior detection engine, coupled with a global IP reputation network. It stacks on fail2ban’s philosophy but is IPV6 compatible and 60x faster (Go vs Python), uses Grok patterns to parse logs and YAML scenario to identify behaviors. CrowdSec is engineered for modern Cloud / Containers / VM based infrastructures (by decoupling detection and remediation). Once detected you can remedy threats with various bouncers (firewall block, nginx http 403, Captchas, etc.) while the aggressive IP can be sent to CrowdSec for curation before being shared among all users to further improve everyone’s security. See FAQ or read bellow for more. 2 Mins Install
Installing it through the Package system of your OS is the easiest way to proceed. Otherwise, you can install it from source. From package (Debian)
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
sudo apt-get update
sudo apt-get install crowdsec
From package (rhel/centos/amazon linux)
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.rpm.sh | sudo bash
sudo yum install crowdsec
From package (FreeBSD)
sudo pkg update
sudo pkg install crowdsec
From source
wget https://github.com/crowdsecurity/crowdsec/releases/latest/download/crowdsec-release.tgz
tar xzvf crowdsec-release.tgz
cd crowdsec-v* && sudo ./wizard.sh -i
About The CrowdSec Project
Crowdsec is an open-source, lightweight software, detecting peers with aggressive behaviors to prevent them from accessing your systems. Its user friendly design and assistance offers a low technical barrier of entry and nevertheless a high security gain.
The architecture is as follows :
https://1.bp.blogspot.com/-XuFJkdHOxds/YUx1wJlrJfI/AAAAAAAAK6g/JxO1qbftRyoJr12S1DslU08lSOX9hT49ACLcBGAsYHQ/s851/crowdsec_architecture.png
Once an unwanted behavior is detected, deal with it through a bouncer. The aggressive IP, scenario triggered and timestamp are sent for curation, to avoid poisoning & false positives. (This can be disabled). If verified, this IP is then redistributed to all CrowdSec users running the same scenario. Outnumbering Hackers All Together
By sharing the threat they faced, all users are protecting each-others (hence the name Crowd-Security). Crowdsec is designed for modern infrastructures, with its “Detect Here, Remedy There” approach, letting you analyse logs coming from several sources in one place and block threats at various levels (applicative, system, infrastructural) of your stack.
CrowdSec ships by default with scenarios (brute force, port scan, web scan, etc.) adapted for most context, but you can easily extend it by picking more of them from the HUB. It is also easy to adapt an existing one or create one yourself.
What It Is Not
CrowdSec is not a SIEM, storing your logs (neither locally nor remotely). Your data are analyzed locally and forgotten.
Signals sent to the curation platform are limited to the very strict minimum: IP, Scenario, Timestamp. They are only used to allow the system to spot new rogue IPs, rule out false positives or poisoning attempts.
Install It
Crowdsec is available for various platforms :
* Use our debian repositories or the official debian packages
* An image is available for docker
* Prebuilt release packages are also available (suitable for
amd64)* You can as well build it from source
Or look directly at installation documentation for other methods and platforms.
Key Benefits Fast assisted installation, no technical barrier
Initial configuration is automated, providing functional out-of-the-box setup
https://1.bp.blogspot.com/-NhfkXihzIXo/YUx3XpqGO_I/AAAAAAAAK6[...]
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
CrowdSec : An Open-Source Massively Multiplayer Firewall
CrowdSec is a free, modern & collaborative behavior detection engine, coupled with a global IP reputation network. It stacks on fail2ban.
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials CrowdSec : An Open-Source Massively Multiplayer Firewall Able To Analyze Visitor Behavior And Provide An Adapted Response To All Kinds Of Attacks CrowdSec is a free, modern & collaborative behavior detection engine, coupled with a global…
o/xiHWWc9YZuMxp8n-10XA5VNsXkwAp1TNQCLcBGAsYHQ/s900/3.gif
Out of the box detection
Baseline detection is effective out-of-the-box, no fine-tuning required (click to expand)
https://1.bp.blogspot.com/-xr0eoPHfTdU/YUx4kJLMDVI/AAAAAAAAK6w/tpiuWzQRvbgOQhAhuX4c8Z8eecXS1ruyACLcBGAsYHQ/s900/4.gif
Easy bouncer deployment
It’s trivial to add bouncers to enforce decisions of crowdsec (click to expand)
https://1.bp.blogspot.com/-hy7fkFBq9gw/YUx5NJx-OdI/AAAAAAAAK64/4PSV3M5L0_Exz9nGz_jPamPZlH0wOrloACLcBGAsYHQ/s900/5.gif
Easy dashboard access
It’s easy to deploy a metabase interface to view your data simply with cscli (click to expand)
https://1.bp.blogspot.com/-cF7coFZ9Vtg/YUx58KFfqUI/AAAAAAAAK7A/149UR6ppSHwLFY5YX0WVFJ-9IaEG1hNUwCLcBGAsYHQ/s900/6.gif
Hot & Cold logs
Process cold logs, for forensic, tests and chasing false-positives & false negatives (click to expand)
https://1.bp.blogspot.com/-YLDwDIV-OV0/YUx6q2klpNI/AAAAAAAAK7I/dhKF4wKbSJQopM3fD1KmUuKKN8Sp-JG2QCLcBGAsYHQ/s900/7.gif Download
___________________________
@hacking_Attack
@Hacking_Video
Out of the box detection
Baseline detection is effective out-of-the-box, no fine-tuning required (click to expand)
https://1.bp.blogspot.com/-xr0eoPHfTdU/YUx4kJLMDVI/AAAAAAAAK6w/tpiuWzQRvbgOQhAhuX4c8Z8eecXS1ruyACLcBGAsYHQ/s900/4.gif
Easy bouncer deployment
It’s trivial to add bouncers to enforce decisions of crowdsec (click to expand)
https://1.bp.blogspot.com/-hy7fkFBq9gw/YUx5NJx-OdI/AAAAAAAAK64/4PSV3M5L0_Exz9nGz_jPamPZlH0wOrloACLcBGAsYHQ/s900/5.gif
Easy dashboard access
It’s easy to deploy a metabase interface to view your data simply with cscli (click to expand)
https://1.bp.blogspot.com/-cF7coFZ9Vtg/YUx58KFfqUI/AAAAAAAAK7A/149UR6ppSHwLFY5YX0WVFJ-9IaEG1hNUwCLcBGAsYHQ/s900/6.gif
Hot & Cold logs
Process cold logs, for forensic, tests and chasing false-positives & false negatives (click to expand)
https://1.bp.blogspot.com/-YLDwDIV-OV0/YUx6q2klpNI/AAAAAAAAK7I/dhKF4wKbSJQopM3fD1KmUuKKN8Sp-JG2QCLcBGAsYHQ/s900/7.gif Download
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Massive Phishing Campaign Impacted 75K Email Inboxes
https://external-preview.redd.it/6OygA_mjK08u-0eBVLCX3I6mcEgF0YsV7nV0GlwwXLI.jpg?width=640&crop=smart&auto=webp&s=018cd24dc8769f66a1c1cee3b8e3d089aec14d71 submitted by /u/george-alexander2k
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Massive Phishing Campaign Impacted 75K Email Inboxes
https://external-preview.redd.it/6OygA_mjK08u-0eBVLCX3I6mcEgF0YsV7nV0GlwwXLI.jpg?width=640&crop=smart&auto=webp&s=018cd24dc8769f66a1c1cee3b8e3d089aec14d71 submitted by /u/george-alexander2k
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Massive Phishing Campaign Impacted 75K Email Inboxes
Posted in r/hacking by u/george-alexander2k • 1 point and 0 comments
hacking: security in practice
Message me if you can hack something for me
I’ll send you like 10 bucks. Should be fairly easy. I’m just unskilled
submitted by /u/mclmnop
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Message me if you can hack something for me
I’ll send you like 10 bucks. Should be fairly easy. I’m just unskilled
submitted by /u/mclmnop
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Message me if you can hack something for me
I’ll send you like 10 bucks. Should be fairly easy. I’m just unskilled